/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ /* * This file is PRIVATE to SSL and should be the first thing included by * any SSL implementation file. * * This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifdef TRACE #define SSL_TRC(a, b) \ if (ssl_trace >= (a)) \
ssl_Trace b #define PRINT_BUF(a, b) \ if (ssl_trace >= (a)) \
ssl_PrintBuf b #define PRINT_KEY(a, b) \ if (ssl_trace >= (a)) \
ssl_PrintKey b #else #define SSL_TRC(a, b) #define PRINT_BUF(a, b) #define PRINT_KEY(a, b) #endif
#ifdef DEBUG #define SSL_DBG(b) \ if (ssl_debug) \
ssl_Trace b #else #define SSL_DBG(b) #endif
/* The default value from RFC 4347 is 1s, which is too slow. */ #define DTLS_RETRANSMIT_INITIAL_MS 50 /* The maximum time to wait between retransmissions. */ #define DTLS_RETRANSMIT_MAX_MS 10000 /* Time to wait in FINISHED state for retransmissions. */ #define DTLS_RETRANSMIT_FINISHED_MS 30000
/* default number of entries in namedGroupPreferences */ #define SSL_NAMED_GROUP_COUNT 33
/* The maximum DH and RSA bit-length supported. */ #define SSL_MAX_DH_KEY_BITS 8192 #define SSL_MAX_RSA_KEY_BITS 8192
/* Types and names of elliptic curves used in TLS */ typedefenum {
ec_type_explicitPrime = 1, /* not supported */
ec_type_explicitChar2Curve = 2, /* not supported */
ec_type_named = 3
} ECType;
struct sslNamedGroupDefStr { /* The name is the value that is encoded on the wire in TLS. */
SSLNamedGroup name; /* The number of bits in the group. */ unsignedint bits; /* The key exchange algorithm this group provides. */
SSLKEAType keaType; /* The OID that identifies the group to PKCS11. This also determines
* whether the group is enabled in policy. */
SECOidTag oidTag; /* Assume that the group is always supported. */
PRBool assumeSupported;
};
/* Socket ops */ struct sslSocketOpsStr { int (*connect)(sslSocket *, const PRNetAddr *);
PRFileDesc *(*accept)(sslSocket *, PRNetAddr *); int (*bind)(sslSocket *, const PRNetAddr *); int (*listen)(sslSocket *, int); int (*shutdown)(sslSocket *, int); int (*close)(sslSocket *);
int (*recv)(sslSocket *, unsignedchar *, int, int);
/* points to the higher-layer send func, e.g. ssl_SecureSend. */ int (*send)(sslSocket *, constunsignedchar *, int, int); int (*read)(sslSocket *, unsignedchar *, int); int (*write)(sslSocket *, constunsignedchar *, int);
int (*getpeername)(sslSocket *, PRNetAddr *); int (*getsockname)(sslSocket *, PRNetAddr *);
};
typedefstruct sslOptionsStr { /* If SSL_SetNextProtoNego has been called, then this contains the
* list of supported protocols. */
SECItem nextProtoNego;
PRUint16 recordSizeLimit;
/* These are the valid values for shutdownHow. ** These values are each 1 greater than the NSPR values, and the code ** depends on that relation to efficiently convert PR_SHUTDOWN values ** into ssl_SHUTDOWN values. These values use one bit for read, and ** another bit for write, and can be used as bitmasks.
*/ #define ssl_SHUTDOWN_NONE 0 /* NOT shutdown at all */ #define ssl_SHUTDOWN_RCV 1 /* PR_SHUTDOWN_RCV +1 */ #define ssl_SHUTDOWN_SEND 2 /* PR_SHUTDOWN_SEND +1 */ #define ssl_SHUTDOWN_BOTH 3 /* PR_SHUTDOWN_BOTH +1 */
/* ** A gather object. Used to read some data until a count has been ** satisfied. Primarily for support of async sockets. ** Everything in here is protected by the recvBufLock.
*/ struct sslGatherStr { int state; /* see GS_ values below. */
/* "buf" holds received plaintext SSL records, after decrypt and MAC check. * recv'd ciphertext records are put in inbuf (see below), then decrypted * into buf.
*/
sslBuffer buf; /*recvBufLock*/
/* number of bytes previously read into hdr or inbuf. ** (offset - writeOffset) is the number of ciphertext bytes read in but ** not yet deciphered.
*/ unsignedint offset;
/* number of bytes to read in next call to ssl_DefRecv (recv) */ unsignedint remainder;
/* DoRecv uses the next two values to extract application data. ** The difference between writeOffset and readOffset is the amount of ** data available to the application. Note that the actual offset of ** the data in "buf" is recordOffset (above), not readOffset. ** In the current implementation, this is made available before the ** MAC is checked!!
*/ unsignedint readOffset; /* Spot where DATA reader (e.g. application ** or handshake code) will read next. ** Always zero for SSl3 application data.
*/ /* offset in buf/inbuf/hdr into which new data will be read from socket. */ unsignedint writeOffset;
/* Buffer for ssl3 to read (encrypted) data from the socket */
sslBuffer inbuf; /*recvBufLock*/
/* The ssl[23]_GatherData functions read data into this buffer, rather ** than into buf or inbuf, while in the GS_HEADER state. ** The portion of the SSL record header put here always comes off the wire ** as plaintext, never ciphertext. ** For SSL3/TLS, the plaintext portion is 5 bytes long. For DTLS it ** varies based on version and header type.
*/ unsignedchar hdr[13]; unsignedint hdrLen;
/* Buffer for DTLS data read off the wire as a single datagram */
sslBuffer dtlsPacket;
/* the start of the buffered DTLS record in dtlsPacket */ unsignedint dtlsPacketOffset;
/* tracks whether we've seen a v3-type record before and must reject
* any further v2-type records. */
PRBool rejectV2Records;
};
typedefenum { never_cached,
in_client_cache,
in_server_cache,
invalid_cache, /* no longer in any cache. */
in_external_cache
} Cached;
#include"sslcert.h"
struct sslSessionIDStr { /* The global cache lock must be held when accessing these members when the * sid is in any cache.
*/
sslSessionID *next; /* chain used for client sockets, only */
Cached cached; int references;
PRTime lastAccessTime;
/* The rest of the members, except for the members of u.ssl3.locked, may * be modified only when the sid is not in any cache.
*/
CERTCertificate *peerCert;
SECItemArray peerCertStatus; /* client only */ constchar *peerID; /* client only */ constchar *urlSvrName; /* client only */ const sslNamedGroupDef *namedCurve; /* (server) for certificate lookup */
CERTCertificate *localCert;
union { struct { /* values that are copied into the server's on-disk SID cache. */
PRUint8 sessionIDLength;
PRUint8 sessionID[SSL3_SESSIONID_BYTES];
ssl3CipherSuite cipherSuite;
PRUint8 policy;
ssl3SidKeys keys; /* mechanism used to wrap master secret */
CK_MECHANISM_TYPE masterWrapMech;
/* The following values pertain to the slot that wrapped the ** master secret. (used only in client)
*/
SECMODModuleID masterModuleID; /* what module wrapped the master secret */
CK_SLOT_ID masterSlotID;
PRUint16 masterWrapIndex; /* what's the key index for the wrapping key */
PRUint16 masterWrapSeries; /* keep track of the slot series, so we don't * accidently try to use new keys after the
* card gets removed and replaced.*/
/* The following values pertain to the slot that did the signature ** for client auth. (used only in client)
*/
SECMODModuleID clAuthModuleID;
CK_SLOT_ID clAuthSlotID;
PRUint16 clAuthSeries;
char masterValid; char clAuthValid;
SECItem srvName;
/* Signed certificate timestamps received in a TLS extension. ** (used only in client).
*/
SECItem signedCertTimestamps;
/* The ALPN value negotiated in the original connection.
* Used for TLS 1.3. */
SECItem alpnSelection;
/* This lock is lazily initialized by CacheSID when a sid is first * cached. Before then, there is no need to lock anything because * the sid isn't being shared by anything.
*/
PRRWLock *lock;
/* The lock must be held while reading or writing these members * because they change while the sid is cached.
*/ struct { /* The session ticket, if we have one, is sent as an extension * in the ClientHello message. This field is used only by * clients. It is protected by lock when lock is non-null * (after the sid has been added to the client session cache).
*/
NewSessionTicket sessionTicket;
} locked;
} ssl3;
} u;
};
/* ** There are tables of these, all const.
*/ typedefstruct { /* An identifier for this struct. */
SSL3KeyExchangeAlgorithm kea; /* The type of key exchange used by the cipher suite. */
SSLKEAType exchKeyType; /* If the cipher suite uses a signature, the type of key used in the
* signature. */
KeyType signKeyType; /* In most cases, cipher suites depend on their signature type for
* authentication, ECDH certificates being the exception. */
SSLAuthType authKeyType; /* True if the key exchange for the suite is ephemeral. Or to be more
* precise: true if the ServerKeyExchange message is always required. */
PRBool ephemeral; /* An OID describing the key exchange */
SECOidTag oid;
} ssl3KEADef;
typedefenum {
ssl_0rtt_none, /* 0-RTT not present */
ssl_0rtt_sent, /* 0-RTT sent (no decision yet) */
ssl_0rtt_accepted, /* 0-RTT sent and accepted */
ssl_0rtt_ignored, /* 0-RTT sent but rejected/ignored */
ssl_0rtt_done /* 0-RTT accepted, but finished */
} sslZeroRttState;
typedefenum {
ssl_0rtt_ignore_none, /* not ignoring */
ssl_0rtt_ignore_trial, /* ignoring with trial decryption */
ssl_0rtt_ignore_hrr /* ignoring until ClientHello (due to HRR) */
} sslZeroRttIgnore;
typedefenum {
client_hello_initial, /* The first attempt. */
client_hello_retry, /* If we receive HelloRetryRequest. */
client_hello_retransmit, /* In DTLS, if we receive HelloVerifyRequest. */
client_hello_renegotiation /* A renegotiation attempt. */
} sslClientHelloType;
/* ** A DTLS queued message (potentially to be retransmitted)
*/ typedefstruct DTLSQueuedMessageStr {
PRCList link; /* The linked list link */
ssl3CipherSpec *cwSpec; /* The cipher spec to use, null for none */
SSLContentType type; /* The message type */ unsignedchar *data; /* The data */
PRUint16 len; /* The data length */
} DTLSQueuedMessage;
struct TLS13KeyShareEntryStr {
PRCList link; /* The linked list link */ const sslNamedGroupDef *group; /* The group for the entry */
SECItem key_exchange; /* The share itself */
};
typedefstruct TLS13EarlyDataStr {
PRCList link; /* The linked list link */ unsignedint consumed; /* How much has been read. */
SECItem data; /* The data */
} TLS13EarlyData;
typedefenum {
handshake_hash_unknown = 0,
handshake_hash_combo = 1, /* The MD5/SHA-1 combination */
handshake_hash_single = 2, /* A single hash */
handshake_hash_record
} SSL3HandshakeHashType;
// A DTLS Timer. typedefvoid (*DTLSTimerCb)(sslSocket *);
/* ** This is the "hs" member of the "ssl3" struct. ** This entire struct is protected by ssl3HandshakeLock
*/ typedefstruct SSL3HandshakeStateStr {
SSL3Random server_random;
SSL3Random client_random;
SSL3Random client_inner_random; /* TLS 1.3 ECH Inner. */
SSL3WaitState ws; /* May also contain SSL3WaitState | 0x80 for TLS 1.3 */
/* This group of members is used for handshake running hashes. */
SSL3HandshakeHashType hashType;
sslBuffer messages; /* Accumulated handshake messages */
sslBuffer echInnerMessages; /* Accumulated ECH Inner handshake messages */ /* PKCS #11 mode: * SSL 3.0 - TLS 1.1 use both |md5| and |sha|. |md5| is used for MD5 and * |sha| for SHA-1. * TLS 1.2 and later use only |sha| variants, for SHA-256. * Under normal (non-1.3 ECH) handshakes, only |sha| and |shaPostHandshake| * are used. When doing 1.3 ECH, |sha| contains the transcript hash * corresponding to the outer Client Hello. To facilitate secure retry and * disablement, |shaEchInner|, tracks, in parallel, the transcript hash * corresponding to the inner Client Hello. Once we process the SH
* extensions, coalesce into |sha|. */
PK11Context *md5;
PK11Context *sha;
PK11Context *shaEchInner;
PK11Context *shaPostHandshake;
SSLSignatureScheme signatureScheme; const ssl3KEADef *kea_def;
ssl3CipherSuite cipher_suite; const ssl3CipherSuiteDef *suite_def;
sslBuffer msg_body; /* protected by recvBufLock */ /* partial handshake message from record layer */ unsignedint header_bytes; /* number of bytes consumed from handshake */ /* message for message type and header length */
SSLHandshakeType msg_type; unsignedlong msg_len;
PRBool isResuming; /* we are resuming (not used in TLS 1.3) */
PRBool sendingSCSV; /* instead of empty RI */
/* The session ticket received in a NewSessionTicket message is temporarily * stored in newSessionTicket until the handshake is finished; then it is * moved to the sid.
*/
PRBool receivedNewSessionTicket;
NewSessionTicket newSessionTicket;
PRUint16 finishedBytes; /* size of single finished below */ union {
TLSFinished tFinished[2]; /* client, then server */
SSL3Finished sFinished[2];
PRUint8 data[72];
} finishedMsgs;
/* True when handshake is blocked on client certificate selection */
PRBool clientCertificatePending; /* Parameters stored whilst waiting for client certificate */
SSLSignatureScheme *clientAuthSignatureSchemes; unsignedint clientAuthSignatureSchemesLen;
PRBool authCertificatePending; /* Which function should SSL_RestartHandshake* call if we're blocked? * One of NULL, ssl3_SendClientSecondRound, ssl3_FinishHandshake,
* or ssl3_AlwaysFail */
sslRestartTarget restartTarget;
PRBool canFalseStart; /* Can/did we False Start */ /* Which preliminaryinfo values have been set. */
PRUint32 preliminaryInfo;
/* Parsed extensions */
PRCList remoteExtensions; /* Parsed incoming extensions */
PRCList echOuterExtensions; /* If ECH, hold CHOuter extensions for decompression. */
/* This group of values is used for DTLS */
PRUint16 sendMessageSeq; /* The sending message sequence
* number */
PRCList lastMessageFlight; /* The last message flight we
* sent */
PRUint16 maxMessageSent; /* The largest message we sent */
PRUint16 recvMessageSeq; /* The receiving message sequence
* number */
sslBuffer recvdFragments; /* The fragments we have received in
* a bitmask */
PRInt32 recvdHighWater; /* The high water mark for fragments * received. -1 means no reassembly
* in progress. */
SECItem cookie; /* The Hello(Retry|Verify)Request cookie. */
dtlsTimer timers[3]; /* Holder for timers. */
dtlsTimer *rtTimer; /* Retransmit timer. */
dtlsTimer *ackTimer; /* Ack timer (DTLS 1.3 only). */
dtlsTimer *hdTimer; /* Read cipher holddown timer (DLTS 1.3 only) */
/* KeyUpdate state machines */
PRBool isKeyUpdateInProgress; /* The status of KeyUpdate -: {true == started, false == finished}. */
PRBool allowPreviousEpoch; /* The flag whether the previous epoch messages are allowed or not: {true == allowed, false == forbidden}. */
PRUint32 rtRetries; /* The retry counter */
SECItem srvVirtName; /* for server: name that was negotiated * with a client. For client - is
* always set to NULL.*/
/* This group of values is used for TLS 1.3 and above */
PK11SymKey *currentSecret; /* The secret down the "left hand side"
* of the TLS 1.3 key schedule. */
PK11SymKey *resumptionMasterSecret; /* The resumption_master_secret. */
PK11SymKey *dheSecret; /* The (EC)DHE shared secret. */
PK11SymKey *clientEarlyTrafficSecret; /* The secret we use for 0-RTT. */
PK11SymKey *clientHsTrafficSecret; /* The source keys for handshake */
PK11SymKey *serverHsTrafficSecret; /* traffic keys. */
PK11SymKey *clientTrafficSecret; /* The source keys for application */
PK11SymKey *serverTrafficSecret; /* traffic keys */
PK11SymKey *earlyExporterSecret; /* for 0-RTT exporters */
PK11SymKey *exporterSecret; /* for exporters */
PRCList cipherSpecs; /* The cipher specs in the sequence they
* will be applied. */
sslZeroRttState zeroRttState; /* Are we doing a 0-RTT handshake? */
sslZeroRttIgnore zeroRttIgnore; /* Are we ignoring 0-RTT? */
ssl3CipherSuite zeroRttSuite; /* The cipher suite we used for 0-RTT. */
PRCList bufferedEarlyData; /* Buffered TLS 1.3 early data
* on server.*/
PRBool helloRetry; /* True if HelloRetryRequest has been sent
* or received. */
PRBool receivedCcs; /* A server received ChangeCipherSpec
* before the handshake started. */
PRBool rejectCcs; /* Excessive ChangeCipherSpecs are rejected. */
PRBool clientCertRequested; /* True if CertificateRequest received. */
PRBool endOfFlight; /* Processed a full flight (DTLS 1.3). */
ssl3KEADef kea_def_mutable; /* Used to hold the writable kea_def
* we use for TLS 1.3 */
PRUint16 ticketNonce; /* A counter we use for tickets. */
SECItem fakeSid; /* ... (server) the SID the client used. */
PRCList psks; /* A list of PSKs, resumption and/or external. */
/* rttEstimate is used to guess the round trip time between server and client. * When the server sends ServerHello it sets this to the current time. * Only after it receives a message from the client's second flight does it
* set the value to something resembling an RTT estimate. */
PRTime rttEstimate;
/* The following lists contain DTLSHandshakeRecordEntry */
PRCList dtlsSentHandshake; /* Used to map records to handshake fragments. */
PRCList dtlsRcvdHandshake; /* Handshake records we have received
* used to generate ACKs. */
/* TLS 1.3 ECH state. */
PRUint8 greaseEchSize;
PRBool echAccepted; /* Client/Server: True if we've commited to using CHInner. */
PRBool echDecided;
HpkeContext *echHpkeCtx; /* Client/Server: HPKE context for ECH. */ constchar *echPublicName; /* Client: If rejected, the ECHConfig.publicName to
* use for certificate verification. */
sslBuffer greaseEchBuf; /* Client: Remember GREASE ECH, as advertised, for CH2 (HRR case).
Server: Remember HRR Grease Value, for transcript calculations */
PRBool echInvalidExtension; /* Client: True if the server offered an invalid extension for the ClientHelloInner */
/* KeyUpdate variables: This is true if we deferred sending a key update as
* post-handshake auth is in progress. */
PRBool keyUpdateDeferred;
tls13KeyUpdateRequest deferredKeyUpdateRequest; /* The identifier of the keyUpdate message that is sent but not yet acknowledged */
PRUint64 dtlsHandhakeKeyUpdateMessage;
/* Used by client to store a message that's to be hashed during the HandleServerHello. */
sslBuffer dtls13ClientMessageBuffer;
} SSL3HandshakeState;
#define SSL_ASSERT_HASHES_EMPTY(ss) \ do { \
PORT_Assert(ss->ssl3.hs.hashType == handshake_hash_unknown); \
PORT_Assert(ss->ssl3.hs.messages.len == 0); \
PORT_Assert(ss->ssl3.hs.echInnerMessages.len == 0); \
} while (0) /* ** This is the "ssl3" struct, as in "ss->ssl3". ** note: ** usually, crSpec == cwSpec and prSpec == pwSpec. ** Sometimes, crSpec == pwSpec and prSpec == cwSpec. ** But there are never more than 2 actual specs. ** No spec must ever be modified if either "current" pointer points to it.
*/ struct ssl3StateStr {
/* ** The following Specs and Spec pointers must be protected using the ** Spec Lock.
*/
ssl3CipherSpec *crSpec; /* current read spec. */
ssl3CipherSpec *prSpec; /* pending read spec. */
ssl3CipherSpec *cwSpec; /* current write spec. */
ssl3CipherSpec *pwSpec; /* pending write spec. */
/* This is true after the peer requests a key update; false after a key
* update is initiated locally. */
PRBool peerRequestedKeyUpdate;
/* This is true after the server requests client certificate; * false after the client certificate is received. Used by the
* server. */
PRBool clientCertRequested;
CERTCertificate *clientCertificate; /* used by client */
SECKEYPrivateKey *clientPrivateKey; /* used by client */
CERTCertificateList *clientCertChain; /* used by client */
PRBool sendEmptyCert; /* used by client */
PRUint8 policy; /* This says what cipher suites we can do, and should * be either SSL_ALLOWED or SSL_RESTRICTED
*/
PLArenaPool *peerCertArena; /* These are used to keep track of the peer CA */ void *peerCertChain; /* chain while we are trying to validate it. */
CERTDistNames *ca_list; /* used by server. trusted CAs for this socket. */
SSL3HandshakeState hs;
PRUint16 mtu; /* Our estimate of the MTU */
/* DTLS-SRTP cipher suite preferences (if any) */
PRUint16 dtlsSRTPCiphers[MAX_DTLS_SRTP_CIPHER_SUITES];
PRUint16 dtlsSRTPCipherCount;
PRBool fatalAlertSent;
PRBool dheWeakGroupEnabled; /* used by server */ const sslNamedGroupDef *dhePreferredGroup;
/* TLS 1.2 introduces separate signature algorithm negotiation. * TLS 1.3 combined signature and hash into a single enum.
* This is our preference order. */
SSLSignatureScheme signatureSchemes[MAX_SIGNATURE_SCHEMES]; unsignedint signatureSchemeCount;
/* The version to check if we fell back from our highest version * of TLS. Default is 0 in which case we check against the maximum
* configured version for this socket. Used only on the client. */
SSL3ProtocolVersion downgradeCheckVersion; /* supported certificate compression algorithms (if any) */
SSLCertificateCompressionAlgorithm supportedCertCompressionAlgorithms[MAX_SUPPORTED_CERTIFICATE_COMPRESSION_ALGS];
PRUint8 supportedCertCompressionAlgorithmsCount;
};
/* Ethernet MTU but without subtracting the headers,
* so slightly larger than expected */ #define DTLS_MAX_MTU 1500U #define IS_DTLS(ss) (ss->protocolVariant == ssl_variant_datagram) #define IS_DTLS_1_OR_12(ss) (IS_DTLS(ss) && ss->version < SSL_LIBRARY_VERSION_TLS_1_3) #define IS_DTLS_13_OR_ABOVE(ss) (IS_DTLS(ss) && ss->version >= SSL_LIBRARY_VERSION_TLS_1_3)
typedefstruct { /* |seqNum| eventually contains the reconstructed sequence number. */
sslSequenceNumber seqNum; /* The header of the cipherText. */
PRUint8 *hdr; unsignedint hdrLen;
/* |buf| is the payload of the ciphertext. */
sslBuffer *buf;
} SSL3Ciphertext;
struct sslKeyPairStr {
SECKEYPrivateKey *privKey;
SECKEYPublicKey *pubKey;
PRInt32 refCount; /* use PR_Atomic calls for this. */
};
/* * msWrapMech contains a meaningful value only if ms_is_wrapped is true.
*/
PRUint8 ms_is_wrapped;
CK_MECHANISM_TYPE msWrapMech;
PRUint16 ms_length;
PRUint8 master_secret[48];
PRBool extendedMasterSecretUsed;
ClientAuthenticationType client_auth_type;
SECItem peer_cert;
PRTime timestamp;
PRUint32 flags;
SECItem srvName; /* negotiated server name */
SECItem alpnSelection;
PRUint32 maxEarlyData;
PRUint32 ticketAgeBaseline;
SECItem applicationToken;
} SessionTicket;
/* * SSL2 buffers used in SSL3. * writeBuf in the SecurityInfo maintained by sslsecur.c is used * to hold the data just about to be passed to the kernel * sendBuf in the ConnectInfo maintained by sslcon.c is used * to hold handshake messages as they are accumulated
*/
/* ** This is "ci", as in "ss->sec.ci". ** ** Protection: All the variables in here are protected by ** firstHandshakeLock AND ssl3HandshakeLock
*/ struct sslConnectInfoStr { /* outgoing handshakes appended to this. */
sslBuffer sendBuf; /*xmitBufLock*/
PRIPv6Addr peer; unsignedshort port;
sslSessionID *sid;
};
/* Note: The entire content of this struct and whatever it points to gets * blown away by SSL_ResetHandshake(). This is "sec" as in "ss->sec". * * Unless otherwise specified below, the contents of this struct are * protected by firstHandshakeLock AND ssl3HandshakeLock.
*/ struct sslSecurityInfoStr {
/* Pointer to operations vector for this socket */ const sslSocketOps *ops;
/* SSL socket options */
sslOptions opt; /* Enabled version range */
SSLVersionRange vrange;
/* A function that returns the current time. */
SSLTimeFunc now; void *nowArg;
/* State flags */ unsignedlong clientAuthRequested; unsignedlong delayDisabled; /* Nagle delay disabled */ unsignedlong firstHsDone; /* first handshake is complete. */ unsignedlong enoughFirstHsDone; /* enough of the first handshake is * done for callbacks to be able to * retrieve channel security
* parameters from the SSL socket. */ unsignedlong handshakeBegun; unsignedlong lastWriteBlocked; unsignedlong recvdCloseNotify; /* received SSL EOF. */ unsignedlong TCPconnected; unsignedlong appDataBuffered; unsignedlong peerRequestedProtection; /* from old renegotiation */
/* version of the protocol to use */
SSL3ProtocolVersion version;
SSL3ProtocolVersion clientHelloVersion; /* version sent in client hello. */
sslSecurityInfo sec; /* not a pointer any more */
/* protected by firstHandshakeLock AND ssl3HandshakeLock. */ constchar *url;
/* the following variable is only used with socks or other proxies. */ char *peerID; /* String uniquely identifies target server. */
/* ECDHE and DHE keys: In TLS 1.3, we might have to maintain multiple of * these on the client side. The server inserts a single value into this
* list for all versions. */
PRCList /*<sslEphemeralKeyPair>*/ ephemeralKeyPairs;
/* Only one thread may operate on the socket until the initial handshake ** is complete. This Monitor ensures that. Since SSL2 handshake is ** only done once, this is also effectively the SSL2 handshake lock.
*/
PZMonitor *firstHandshakeLock;
/* This monitor protects the ssl3 handshake state machine data. ** Only one thread (reader or writer) may be in the ssl3 handshake state
** machine at any time. */
PZMonitor *ssl3HandshakeLock;
/* reader/writer lock, protects the secret data needed to encrypt and MAC ** outgoing records, and to decrypt and MAC check incoming ciphertext
** records. */
NSSRWLock *specLock;
/* handle to perm cert db (and implicitly to the temp cert db) used ** with this socket.
*/
CERTCertDBHandle *dbHandle;
/* A list of groups that are sorted according to user preferences pointing * to entries of ssl_named_groups. By default this list contains pointers * to all elements in ssl_named_groups in the default order. * This list also determines which groups are enabled. This * starts with all being enabled and can be modified either by negotiation * (in which case groups not supported by a peer are masked off), or by * calling SSL_DHEGroupPrefSet(). * Note that renegotiation will ignore groups that were disabled in the * first handshake.
*/ const sslNamedGroupDef *namedGroupPreferences[SSL_NAMED_GROUP_COUNT]; /* The number of additional shares to generate for the TLS 1.3 ClientHello */ unsignedint additionalShares;
/* SSL3 state info. Formerly was a pointer */
ssl3State ssl3;
/* * TLS extension related data.
*/ /* True when the current session is a stateless resume. */
PRBool statelessResume;
TLSExtensionData xtnData;
/* Whether we are doing stream or datagram mode */
SSLProtocolVariant protocolVariant;
/* TLS 1.3 Encrypted Client Hello. */
PRCList echConfigs; /* Client/server: Must not change while hs
* is in-progress. */
SECKEYPublicKey *echPubKey; /* Server: The ECH keypair used in HPKE. */
SECKEYPrivateKey *echPrivKey; /* As above. */
/* Anti-replay for TLS 1.3 0-RTT. */
SSLAntiReplayContext *antiReplay;
/* Returns PR_TRUE if we are still waiting for the server to complete its * response to our client second round. Once we've received the Finished from * the server then there is no need to check false start.
*/ extern PRBool ssl3_WaitingForServerSecondRound(sslSocket *ss);
/* Placeholder value used in version ranges when SSL 3.0 and all * versions of TLS are disabled.
*/ #define SSL_LIBRARY_VERSION_NONE 0
/* SSL_LIBRARY_VERSION_MIN_SUPPORTED is the minimum version that this version * of libssl supports. Applications should use SSL_VersionRangeGetSupported at * runtime to determine which versions are supported by the version of libssl * in use.
*/ #define SSL_LIBRARY_VERSION_MIN_SUPPORTED_DATAGRAM SSL_LIBRARY_VERSION_TLS_1_1 #define SSL_LIBRARY_VERSION_MIN_SUPPORTED_STREAM SSL_LIBRARY_VERSION_3_0
/* SSL_LIBRARY_VERSION_MAX_SUPPORTED is the maximum version that this version * of libssl supports. Applications should use SSL_VersionRangeGetSupported at * runtime to determine which versions are supported by the version of libssl * in use.
*/ #ifndef NSS_DISABLE_TLS_1_3 #define SSL_LIBRARY_VERSION_MAX_SUPPORTED SSL_LIBRARY_VERSION_TLS_1_3 #else #define SSL_LIBRARY_VERSION_MAX_SUPPORTED SSL_LIBRARY_VERSION_TLS_1_2 #endif
/* Construct a new NSPR socket for the app to use */ extern PRFileDesc *ssl_NewPRSocket(sslSocket *ss, PRFileDesc *fd); externvoid ssl_FreePRSocket(PRFileDesc *fd);
/* Internal config function so SSL3 can initialize the present state of
* various ciphers */ externunsignedint ssl3_config_match_init(sslSocket *);
/* Return PR_TRUE if suite is usable. This if the suite is permitted by policy, * enabled, has a certificate (as needed), has a viable key agreement method, is
* usable with the negotiated TLS version, and is otherwise usable. */
PRBool ssl3_config_match(const ssl3CipherSuiteCfg *suite, PRUint8 policy, const SSLVersionRange *vrange, const sslSocket *ss);
/* calls for accessing wrapping keys across processes. */ extern SECStatus
ssl_GetWrappingKey(unsignedint symWrapMechIndex, unsignedint wrapKeyIndex, SSLWrappedSymWrappingKey *wswk);
/* The caller passes in the new value it wants * to set. This code tests the wrapped sym key entry in the file on disk. * If it is uninitialized, this function writes the caller's value into * the disk entry, and returns false. * Otherwise, it overwrites the caller's wswk with the value obtained from * the disk, and returns PR_TRUE. * This is all done while holding the locks/semaphores necessary to make * the operation atomic.
*/ extern SECStatus
ssl_SetWrappingKey(SSLWrappedSymWrappingKey *wswk);
/* get rid of the symmetric wrapping key references. */ extern SECStatus SSL3_ShutdownServerCache(void);
/* unwrap helper function to handle the case where the wrapKey doesn't wind
* * up in the correct token for the master secret */
PK11SymKey *ssl_unwrapSymKey(PK11SymKey *wrapKey,
CK_MECHANISM_TYPE wrapType, SECItem *param,
SECItem *wrappedKey,
CK_MECHANISM_TYPE target, CK_ATTRIBUTE_TYPE operation, int keySize, CK_FLAGS keyFlags, void *pinArg);
/* determine if the current ssl connection is operating in FIPS mode */
PRBool ssl_isFIPS(sslSocket *ss);
/* The next function is responsible for registering a certificate compression mechanism to be used for TLS connection. The caller passes SSLCertificateCompressionAlgorithm algorithm:
Certificate Compression encoding function is responsible for allocating the output buffer itself. If encoding function fails, the function has the install the appropriate error code and return an error.
Certificate Compression decoding function operates an output buffer allocated in NSS. The function returns success or an error code. If successful, the function sets the number of bytes used to stored the decoded certificate in the outparam usedLen. If provided buffer is not enough to store the output (or any problem has occured during decoding of the buffer), the function has the install the appropriate error code and return an error. Note: usedLen is always <= outputLen.
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.
